@open-mercato/core 0.10.1-develop.7741.1.61a2652671 → 0.10.1-develop.7748.1.d745ba61aa

package/dist/helpers/integration/attachmentAccessFixtures.js

@@ -0,0 +1,144 @@
+import { randomUUID } from "node:crypto";
+import { expect } from "@playwright/test";
+import { apiRequest, clearAuthTokenCache, getAuthToken, withCredentialIsolatedRequest } from "./api.js";
+import { createRoleFixture, createUserFixture, deleteRoleIfExists, deleteUserIfExists, setRoleAclFeatures } from "./authFixtures.js";
+import { deleteAttachmentIfExists, uploadAttachmentFixture } from "./attachmentsFixtures.js";
+import { expectId, getTokenContext, readJsonSafe } from "./generalFixtures.js";
+const OWNER_ACCESS_FEATURES = [
+  "documents.view",
+  "documents.edit",
+  "documents.create",
+  "documents.share",
+  "documents.delete",
+  "attachments.view",
+  "attachments.manage"
+];
+const OWNER_ACCESS_PNG = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAYAAABytg0kAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEUlEQVQImWMwSpn2H4QZYAwASOwIrfM45AsAAAAASUVORK5CYII=",
+  "base64"
+);
+async function ownerPolicyRequest(method, path, token, data, scheme = "Bearer") {
+  return withCredentialIsolatedRequest(async (isolated) => {
+    const response = await isolated.fetch(path, {
+      method,
+      headers: { Authorization: `${scheme} ${token}`, "Content-Type": "application/json" },
+      ...data === void 0 ? {} : { data }
+    });
+    return {
+      status: response.status(),
+      headers: response.headers(),
+      body: await readJsonSafe(response),
+      bytes: await response.body()
+    };
+  });
+}
+async function withAttachmentOwnerFixture(request, run) {
+  const admin = await getAuthToken(request, "admin");
+  const scope = getTokenContext(admin);
+  const prefix = `attachment-owner-${randomUUID()}`;
+  const users = [], documents = [], attachments = [], keys = [];
+  let roleId = null;
+  try {
+    roleId = await createRoleFixture(request, admin, { name: prefix, tenantId: scope.tenantId });
+    await setRoleAclFeatures(request, admin, { roleId, features: OWNER_ACCESS_FEATURES });
+    const actor = async (label) => {
+      const email = `${prefix}-${label}@example.com`, password = `Owner1!${randomUUID()}`;
+      const id = await createUserFixture(request, admin, {
+        email,
+        password,
+        organizationId: scope.organizationId,
+        roles: [roleId],
+        name: label
+      });
+      users.push(id);
+      return { id, token: await getAuthToken(request, email, password), refreshToken: async () => {
+        clearAuthTokenCache();
+        return getAuthToken(request, email, password);
+      } };
+    };
+    const recipient = await actor("recipient"), unshared = await actor("unshared");
+    const document = async (label, token = admin) => {
+      const response = await apiRequest(request, "POST", "/api/documents", { token, data: { title: `${prefix}-${label}`, folderId: null } });
+      expect(response.status()).toBe(201);
+      const body = await readJsonSafe(response);
+      const id = expectId(body?.id, "Fixture response must include id");
+      documents.push(id);
+      return id;
+    };
+    const share = async (documentId, permission, principalType = "user", principalId = recipient.id, token = admin) => {
+      const response = await apiRequest(request, "POST", `/api/documents/${documentId}/shares`, {
+        token,
+        data: { principalType, principalId, permission }
+      });
+      expect(response.status()).toBe(201);
+      const body = await readJsonSafe(response);
+      expect(body?.updatedAt).toBeTruthy();
+      return { id: expectId(body?.id, "Fixture response must include id"), updatedAt: body.updatedAt };
+    };
+    const upload = async (documentId, label, options = {}) => {
+      const file = await uploadAttachmentFixture(request, admin, {
+        entityId: options.entityId ?? "documents:document",
+        recordId: documentId,
+        fileName: `${prefix}-${label}.txt`,
+        mimeType: "text/plain",
+        buffer: Buffer.from(`${prefix}-${label}-content`),
+        assignments: options.assignments,
+        tags: options.tags
+      });
+      attachments.push(file.id);
+      return file.id;
+    };
+    const uploadProxy = async (documentId) => {
+      const route = `/api/documents/${documentId}/attachments`;
+      const response = await request.fetch(process.env.BASE_URL?.trim() ? `${process.env.BASE_URL.trim()}${route}` : route, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${admin}` },
+        multipart: { file: { name: `${prefix}-proxy.png`, mimeType: "image/png", buffer: OWNER_ACCESS_PNG } }
+      });
+      expect(response.status()).toBe(201);
+      const body = await readJsonSafe(response);
+      return { attachmentId: expectId(body?.attachmentId, "Document upload must include attachmentId"), url: String(body?.url) };
+    };
+    const key = async () => {
+      const response = await apiRequest(request, "POST", "/api/api_keys/keys", {
+        token: admin,
+        data: { name: prefix, tenantId: scope.tenantId, organizationId: scope.organizationId, roles: [roleId] }
+      });
+      expect(response.status()).toBe(201);
+      const body = await readJsonSafe(response);
+      const id = expectId(body?.id, "Fixture response must include id");
+      keys.push(id);
+      expect(body?.secret).toMatch(/^omk_/);
+      return { id, secret: body.secret };
+    };
+    const uploadPublicImage = async (documentId) => {
+      const file = await uploadAttachmentFixture(request, admin, {
+        entityId: "catalog:catalog_product",
+        recordId: randomUUID(),
+        fileName: `${prefix}-public.png`,
+        mimeType: "image/png",
+        buffer: OWNER_ACCESS_PNG,
+        assignments: [{ type: "documents:document", id: documentId }]
+      });
+      attachments.push(file.id);
+      expect(file.partitionCode).toBe("productsMedia");
+      return file.id;
+    };
+    const visible = await document("visible"), hidden = await document("hidden"), destination = await document("destination");
+    await share(visible, "viewer");
+    await run({ admin, roleId, prefix, recipient, unshared, visible, hidden, destination, document, share, upload, uploadProxy, uploadPublicImage, key });
+  } finally {
+    for (const id of keys) await apiRequest(request, "DELETE", `/api/api_keys/keys?id=${id}`, { token: admin }).catch(() => void 0);
+    for (const id of attachments) await deleteAttachmentIfExists(request, admin, id);
+    for (const id of documents.reverse()) await apiRequest(request, "DELETE", `/api/documents/${id}`, { token: admin }).catch(() => void 0);
+    for (const id of users) await deleteUserIfExists(request, admin, id);
+    await deleteRoleIfExists(request, admin, roleId);
+  }
+}
+export {
+  OWNER_ACCESS_FEATURES,
+  OWNER_ACCESS_PNG,
+  ownerPolicyRequest,
+  withAttachmentOwnerFixture
+};
+//# sourceMappingURL=attachmentAccessFixtures.js.map

package/dist/helpers/integration/attachmentAccessFixtures.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/helpers/integration/attachmentAccessFixtures.ts"],
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { expect, type APIRequestContext } from '@playwright/test'\nimport { apiRequest, clearAuthTokenCache, getAuthToken, withCredentialIsolatedRequest } from './api'\nimport { createRoleFixture, createUserFixture, deleteRoleIfExists, deleteUserIfExists, setRoleAclFeatures } from './authFixtures'\nimport { deleteAttachmentIfExists, uploadAttachmentFixture } from './attachmentsFixtures'\nimport { expectId, getTokenContext, readJsonSafe } from './generalFixtures'\n\nexport const OWNER_ACCESS_FEATURES = [\n  'documents.view', 'documents.edit', 'documents.create', 'documents.share', 'documents.delete',\n  'attachments.view', 'attachments.manage',\n]\nexport const OWNER_ACCESS_PNG = Buffer.from(\n  'iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAYAAABytg0kAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEUlEQVQImWMwSpn2H4QZYAwASOwIrfM45AsAAAAASUVORK5CYII=',\n  'base64',\n)\n\nexport type OwnerAccessItem = { id: string; tags?: string[]; assignments?: Array<{ type: string; id: string; label?: string | null }> }\nexport type OwnerAccessList = { items: OwnerAccessItem[]; total?: number; availableTags?: string[] }\nexport type OwnerAccessActor = { id: string; token: string; refreshToken: () => Promise<string> }\ntype Assignment = { type: string; id: string; label?: string }\ntype Share = { id: string; updatedAt: string }\n\nexport async function ownerPolicyRequest<Body = { error?: string }>(\n  method: string, path: string, token: string, data?: unknown, scheme: 'Bearer' | 'ApiKey' = 'Bearer',\n) {\n  return withCredentialIsolatedRequest(async (isolated) => {\n    const response = await isolated.fetch(path, {\n      method, headers: { Authorization: `${scheme} ${token}`, 'Content-Type': 'application/json' },\n      ...(data === undefined ? {} : { data }),\n    })\n    return {\n      status: response.status(), headers: response.headers(),\n      body: await readJsonSafe<Body>(response), bytes: await response.body(),\n    }\n  })\n}\n\nexport type AttachmentOwnerFixture = {\n  admin: string\n  roleId: string\n  prefix: string\n  recipient: OwnerAccessActor\n  unshared: OwnerAccessActor\n  visible: string\n  hidden: string\n  destination: string\n  document: (label: string, token?: string) => Promise<string>\n  share: (documentId: string, permission: 'viewer' | 'editor', principalType?: 'user' | 'role', principalId?: string, token?: string) => Promise<Share>\n  upload: (documentId: string, label: string, options?: { entityId?: string; assignments?: Assignment[]; tags?: string[] }) => Promise<string>\n  uploadProxy: (documentId: string) => Promise<{ attachmentId: string; url: string }>\n  uploadPublicImage: (documentId: string) => Promise<string>\n  key: () => Promise<{ id: string; secret: string }>\n}\n\nexport async function withAttachmentOwnerFixture(\n  request: APIRequestContext, run: (fixture: AttachmentOwnerFixture) => Promise<void>,\n): Promise<void> {\n  const admin = await getAuthToken(request, 'admin')\n  const scope = getTokenContext(admin)\n  const prefix = `attachment-owner-${randomUUID()}`\n  const users: string[] = [], documents: string[] = [], attachments: string[] = [], keys: string[] = []\n  let roleId: string | null = null\n  try {\n    roleId = await createRoleFixture(request, admin, { name: prefix, tenantId: scope.tenantId })\n    await setRoleAclFeatures(request, admin, { roleId, features: OWNER_ACCESS_FEATURES })\n    const actor = async (label: string): Promise<OwnerAccessActor> => {\n      const email = `${prefix}-${label}@example.com`, password = `Owner1!${randomUUID()}`\n      const id = await createUserFixture(request, admin, {\n        email, password, organizationId: scope.organizationId, roles: [roleId!], name: label,\n      })\n      users.push(id)\n      return { id, token: await getAuthToken(request, email, password), refreshToken: async () => {\n        clearAuthTokenCache()\n        return getAuthToken(request, email, password)\n      } }\n    }\n    const recipient = await actor('recipient'), unshared = await actor('unshared')\n    const document = async (label: string, token = admin): Promise<string> => {\n      const response = await apiRequest(request, 'POST', '/api/documents', { token, data: { title: `${prefix}-${label}`, folderId: null } })\n      expect(response.status()).toBe(201)\n      const body = await readJsonSafe<{ id: string }>(response)\n      const id = expectId(body?.id, 'Fixture response must include id'); documents.push(id); return id\n    }\n    const share: AttachmentOwnerFixture['share'] = async (documentId, permission, principalType = 'user', principalId = recipient.id, token = admin) => {\n      const response = await apiRequest(request, 'POST', `/api/documents/${documentId}/shares`, {\n        token, data: { principalType, principalId, permission },\n      })\n      expect(response.status()).toBe(201)\n      const body = await readJsonSafe<Share>(response)\n      expect(body?.updatedAt).toBeTruthy()\n      return { id: expectId(body?.id, 'Fixture response must include id'), updatedAt: body!.updatedAt }\n    }\n    const upload: AttachmentOwnerFixture['upload'] = async (documentId, label, options = {}) => {\n      const file = await uploadAttachmentFixture(request, admin, {\n        entityId: options.entityId ?? 'documents:document', recordId: documentId,\n        fileName: `${prefix}-${label}.txt`, mimeType: 'text/plain', buffer: Buffer.from(`${prefix}-${label}-content`),\n        assignments: options.assignments, tags: options.tags,\n      })\n      attachments.push(file.id); return file.id\n    }\n    const uploadProxy = async (documentId: string) => {\n      const route = `/api/documents/${documentId}/attachments`\n      const response = await request.fetch(process.env.BASE_URL?.trim() ? `${process.env.BASE_URL.trim()}${route}` : route, {\n        method: 'POST', headers: { Authorization: `Bearer ${admin}` },\n        multipart: { file: { name: `${prefix}-proxy.png`, mimeType: 'image/png', buffer: OWNER_ACCESS_PNG } },\n      })\n      expect(response.status()).toBe(201)\n      const body = await readJsonSafe<{ attachmentId: string; url: string }>(response)\n      return { attachmentId: expectId(body?.attachmentId, 'Document upload must include attachmentId'), url: String(body?.url) }\n    }\n    const key = async () => {\n      const response = await apiRequest(request, 'POST', '/api/api_keys/keys', {\n        token: admin, data: { name: prefix, tenantId: scope.tenantId, organizationId: scope.organizationId, roles: [roleId] },\n      })\n      expect(response.status()).toBe(201)\n      const body = await readJsonSafe<{ id: string; secret: string }>(response)\n      const id = expectId(body?.id, 'Fixture response must include id'); keys.push(id)\n      expect(body?.secret).toMatch(/^omk_/)\n      return { id, secret: body!.secret }\n    }\n    const uploadPublicImage = async (documentId: string) => {\n      const file = await uploadAttachmentFixture(request, admin, {\n        entityId: 'catalog:catalog_product', recordId: randomUUID(),\n        fileName: `${prefix}-public.png`, mimeType: 'image/png', buffer: OWNER_ACCESS_PNG,\n        assignments: [{ type: 'documents:document', id: documentId }],\n      })\n      attachments.push(file.id)\n      expect(file.partitionCode).toBe('productsMedia')\n      return file.id\n    }\n    const visible = await document('visible'), hidden = await document('hidden'), destination = await document('destination')\n    await share(visible, 'viewer')\n    await run({ admin, roleId, prefix, recipient, unshared, visible, hidden, destination, document, share, upload, uploadProxy, uploadPublicImage, key })\n  } finally {\n    for (const id of keys) await apiRequest(request, 'DELETE', `/api/api_keys/keys?id=${id}`, { token: admin }).catch(() => undefined)\n    for (const id of attachments) await deleteAttachmentIfExists(request, admin, id)\n    for (const id of documents.reverse()) await apiRequest(request, 'DELETE', `/api/documents/${id}`, { token: admin }).catch(() => undefined)\n    for (const id of users) await deleteUserIfExists(request, admin, id)\n    await deleteRoleIfExists(request, admin, roleId)\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,cAAsC;AAC/C,SAAS,YAAY,qBAAqB,cAAc,qCAAqC;AAC7F,SAAS,mBAAmB,mBAAmB,oBAAoB,oBAAoB,0BAA0B;AACjH,SAAS,0BAA0B,+BAA+B;AAClE,SAAS,UAAU,iBAAiB,oBAAoB;AAEjD,MAAM,wBAAwB;AAAA,EACnC;AAAA,EAAkB;AAAA,EAAkB;AAAA,EAAoB;AAAA,EAAmB;AAAA,EAC3E;AAAA,EAAoB;AACtB;AACO,MAAM,mBAAmB,OAAO;AAAA,EACrC;AAAA,EACA;AACF;AAQA,eAAsB,mBACpB,QAAgB,MAAc,OAAe,MAAgB,SAA8B,UAC3F;AACA,SAAO,8BAA8B,OAAO,aAAa;AACvD,UAAM,WAAW,MAAM,SAAS,MAAM,MAAM;AAAA,MAC1C;AAAA,MAAQ,SAAS,EAAE,eAAe,GAAG,MAAM,IAAI,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,MAC3F,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK;AAAA,IACvC,CAAC;AACD,WAAO;AAAA,MACL,QAAQ,SAAS,OAAO;AAAA,MAAG,SAAS,SAAS,QAAQ;AAAA,MACrD,MAAM,MAAM,aAAmB,QAAQ;AAAA,MAAG,OAAO,MAAM,SAAS,KAAK;AAAA,IACvE;AAAA,EACF,CAAC;AACH;AAmBA,eAAsB,2BACpB,SAA4B,KACb;AACf,QAAM,QAAQ,MAAM,aAAa,SAAS,OAAO;AACjD,QAAM,QAAQ,gBAAgB,KAAK;AACnC,QAAM,SAAS,oBAAoB,WAAW,CAAC;AAC/C,QAAM,QAAkB,CAAC,GAAG,YAAsB,CAAC,GAAG,cAAwB,CAAC,GAAG,OAAiB,CAAC;AACpG,MAAI,SAAwB;AAC5B,MAAI;AACF,aAAS,MAAM,kBAAkB,SAAS,OAAO,EAAE,MAAM,QAAQ,UAAU,MAAM,SAAS,CAAC;AAC3F,UAAM,mBAAmB,SAAS,OAAO,EAAE,QAAQ,UAAU,sBAAsB,CAAC;AACpF,UAAM,QAAQ,OAAO,UAA6C;AAChE,YAAM,QAAQ,GAAG,MAAM,IAAI,KAAK,gBAAgB,WAAW,UAAU,WAAW,CAAC;AACjF,YAAM,KAAK,MAAM,kBAAkB,SAAS,OAAO;AAAA,QACjD;AAAA,QAAO;AAAA,QAAU,gBAAgB,MAAM;AAAA,QAAgB,OAAO,CAAC,MAAO;AAAA,QAAG,MAAM;AAAA,MACjF,CAAC;AACD,YAAM,KAAK,EAAE;AACb,aAAO,EAAE,IAAI,OAAO,MAAM,aAAa,SAAS,OAAO,QAAQ,GAAG,cAAc,YAAY;AAC1F,4BAAoB;AACpB,eAAO,aAAa,SAAS,OAAO,QAAQ;AAAA,MAC9C,EAAE;AAAA,IACJ;AACA,UAAM,YAAY,MAAM,MAAM,WAAW,GAAG,WAAW,MAAM,MAAM,UAAU;AAC7E,UAAM,WAAW,OAAO,OAAe,QAAQ,UAA2B;AACxE,YAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,kBAAkB,EAAE,OAAO,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,KAAK,IAAI,UAAU,KAAK,EAAE,CAAC;AACrI,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,YAAM,OAAO,MAAM,aAA6B,QAAQ;AACxD,YAAM,KAAK,SAAS,MAAM,IAAI,kCAAkC;AAAG,gBAAU,KAAK,EAAE;AAAG,aAAO;AAAA,IAChG;AACA,UAAM,QAAyC,OAAO,YAAY,YAAY,gBAAgB,QAAQ,cAAc,UAAU,IAAI,QAAQ,UAAU;AAClJ,YAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,kBAAkB,UAAU,WAAW;AAAA,QACxF;AAAA,QAAO,MAAM,EAAE,eAAe,aAAa,WAAW;AAAA,MACxD,CAAC;AACD,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,YAAM,OAAO,MAAM,aAAoB,QAAQ;AAC/C,aAAO,MAAM,SAAS,EAAE,WAAW;AACnC,aAAO,EAAE,IAAI,SAAS,MAAM,IAAI,kCAAkC,GAAG,WAAW,KAAM,UAAU;AAAA,IAClG;AACA,UAAM,SAA2C,OAAO,YAAY,OAAO,UAAU,CAAC,MAAM;AAC1F,YAAM,OAAO,MAAM,wBAAwB,SAAS,OAAO;AAAA,QACzD,UAAU,QAAQ,YAAY;AAAA,QAAsB,UAAU;AAAA,QAC9D,UAAU,GAAG,MAAM,IAAI,KAAK;AAAA,QAAQ,UAAU;AAAA,QAAc,QAAQ,OAAO,KAAK,GAAG,MAAM,IAAI,KAAK,UAAU;AAAA,QAC5G,aAAa,QAAQ;AAAA,QAAa,MAAM,QAAQ;AAAA,MAClD,CAAC;AACD,kBAAY,KAAK,KAAK,EAAE;AAAG,aAAO,KAAK;AAAA,IACzC;AACA,UAAM,cAAc,OAAO,eAAuB;AAChD,YAAM,QAAQ,kBAAkB,UAAU;AAC1C,YAAM,WAAW,MAAM,QAAQ,MAAM,QAAQ,IAAI,UAAU,KAAK,IAAI,GAAG,QAAQ,IAAI,SAAS,KAAK,CAAC,GAAG,KAAK,KAAK,OAAO;AAAA,QACpH,QAAQ;AAAA,QAAQ,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,QAC5D,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,cAAc,UAAU,aAAa,QAAQ,iBAAiB,EAAE;AAAA,MACtG,CAAC;AACD,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,YAAM,OAAO,MAAM,aAAoD,QAAQ;AAC/E,aAAO,EAAE,cAAc,SAAS,MAAM,cAAc,2CAA2C,GAAG,KAAK,OAAO,MAAM,GAAG,EAAE;AAAA,IAC3H;AACA,UAAM,MAAM,YAAY;AACtB,YAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,sBAAsB;AAAA,QACvE,OAAO;AAAA,QAAO,MAAM,EAAE,MAAM,QAAQ,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,OAAO,CAAC,MAAM,EAAE;AAAA,MACtH,CAAC;AACD,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,YAAM,OAAO,MAAM,aAA6C,QAAQ;AACxE,YAAM,KAAK,SAAS,MAAM,IAAI,kCAAkC;AAAG,WAAK,KAAK,EAAE;AAC/E,aAAO,MAAM,MAAM,EAAE,QAAQ,OAAO;AACpC,aAAO,EAAE,IAAI,QAAQ,KAAM,OAAO;AAAA,IACpC;AACA,UAAM,oBAAoB,OAAO,eAAuB;AACtD,YAAM,OAAO,MAAM,wBAAwB,SAAS,OAAO;AAAA,QACzD,UAAU;AAAA,QAA2B,UAAU,WAAW;AAAA,QAC1D,UAAU,GAAG,MAAM;AAAA,QAAe,UAAU;AAAA,QAAa,QAAQ;AAAA,QACjE,aAAa,CAAC,EAAE,MAAM,sBAAsB,IAAI,WAAW,CAAC;AAAA,MAC9D,CAAC;AACD,kBAAY,KAAK,KAAK,EAAE;AACxB,aAAO,KAAK,aAAa,EAAE,KAAK,eAAe;AAC/C,aAAO,KAAK;AAAA,IACd;AACA,UAAM,UAAU,MAAM,SAAS,SAAS,GAAG,SAAS,MAAM,SAAS,QAAQ,GAAG,cAAc,MAAM,SAAS,aAAa;AACxH,UAAM,MAAM,SAAS,QAAQ;AAC7B,UAAM,IAAI,EAAE,OAAO,QAAQ,QAAQ,WAAW,UAAU,SAAS,QAAQ,aAAa,UAAU,OAAO,QAAQ,aAAa,mBAAmB,IAAI,CAAC;AAAA,EACtJ,UAAE;AACA,eAAW,MAAM,KAAM,OAAM,WAAW,SAAS,UAAU,yBAAyB,EAAE,IAAI,EAAE,OAAO,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AACjI,eAAW,MAAM,YAAa,OAAM,yBAAyB,SAAS,OAAO,EAAE;AAC/E,eAAW,MAAM,UAAU,QAAQ,EAAG,OAAM,WAAW,SAAS,UAAU,kBAAkB,EAAE,IAAI,EAAE,OAAO,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AACzI,eAAW,MAAM,MAAO,OAAM,mBAAmB,SAAS,OAAO,EAAE;AACnE,UAAM,mBAAmB,SAAS,OAAO,MAAM;AAAA,EACjD;AACF;",
+  "names": []
+}

package/dist/modules/attachments/api/file/[id]/route.js

@@ -1,3 +1,5 @@
+import { createAttachmentAccessContext, evaluateAttachmentAccess } from "../../../lib/access-runner.js";
+import { attachmentAccessErrorResponse } from "../../../lib/access-errors.js";
 import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
@@ -58,11 +60,17 @@ async function GET(req, context) {
       { status: 500 }
     );
   }
-  const access = checkAttachmentAccess(scopedAuth, attachment, partition);
-  if (!access.ok) {
-    const message = access.status === 401 ? "Unauthorized" : "Forbidden";
-    return NextResponse.json({ error: message }, { status: access.status });
-  }
+  const url = new URL(req.url);
+  const forceDownload = url.searchParams.get("download") === "1";
+  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);
+  const access = await evaluateAttachmentAccess({
+    auth: scopedAuth,
+    attachment,
+    partition,
+    action: renderInline ? "render" : "read",
+    context: createAttachmentAccessContext(container)
+  });
+  if (!access.ok) return attachmentAccessErrorResponse(access);
   const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {
     tenantId: attachment.tenantId ?? "",
     organizationId: attachment.organizationId ?? ""
@@ -74,11 +82,8 @@ async function GET(req, context) {
   } catch {
     return NextResponse.json({ error: "File not available" }, { status: 404 });
   }
-  const url = new URL(req.url);
-  const forceDownload = url.searchParams.get("download") === "1";
-  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);
   const headers = {
-    "Cache-Control": checkAttachmentAccess(null, attachment, partition).ok ? "public, max-age=86400" : "private, max-age=60",
+    "Cache-Control": access.protected ? "private, no-store" : checkAttachmentAccess(null, attachment, partition).ok ? "public, max-age=86400" : "private, max-age=60",
     "Content-Security-Policy": "default-src 'none'; sandbox",
     "Content-Type": renderInline ? attachment.mimeType || "application/octet-stream" : "application/octet-stream",
     "Content-Disposition": buildAttachmentContentDisposition(
@@ -132,7 +137,8 @@ const openApi = {
           status: 500,
           description: "Partition misconfigured",
           schema: attachmentErrorSchema
-        }
+        },
+        { status: 504, description: "Owner authorization timed out", schema: attachmentErrorSchema }
       ]
     }
   }

package/dist/modules/attachments/api/file/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/attachments/api/file/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextRequest, NextResponse } from \"next/server\";\nimport type { OpenApiRouteDoc } from \"@open-mercato/shared/lib/openapi\";\nimport { getAuthFromRequest } from \"@open-mercato/shared/lib/auth/server\";\nimport { createRequestContainer } from \"@open-mercato/shared/lib/di/container\";\nimport {\n  Attachment,\n  AttachmentPartition,\n} from \"@open-mercato/core/modules/attachments/data/entities\";\nimport type { EntityManager } from \"@mikro-orm/postgresql\";\nimport { checkAttachmentAccess, isSuperAdminAuth } from \"@open-mercato/core/modules/attachments/lib/access\";\nimport { z } from \"zod\";\nimport { attachmentsTag, attachmentErrorSchema } from \"../../openapi\";\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n} from \"@open-mercato/core/modules/attachments/lib/security\";\nimport { StorageDriverFactory } from '../../../lib/drivers';\nimport { resolveAttachmentRequestScope } from '@open-mercato/core/modules/attachments/lib/requestScope';\n\nexport const metadata = {\n  GET: { requireAuth: false },\n};\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string }> },\n) {\n  const { id } = await context.params;\n  if (!id) {\n    return NextResponse.json(\n      { error: \"Attachment id is required\" },\n      { status: 400 },\n    );\n  }\n  const auth = await getAuthFromRequest(req);\n  const container = await createRequestContainer();\n  const em = container.resolve(\"em\") as EntityManager;\n  const storageDriverFactory =\n    (container.resolve(\"storageDriverFactory\") as StorageDriverFactory | null) ??\n    new StorageDriverFactory(em);\n\n  const requestScope = await resolveAttachmentRequestScope(container, auth, req);\n  if (requestScope.denied) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const scopedAuth = auth ? { ...auth, orgId: requestScope.organizationId } : auth;\n  const findFilter: Record<string, unknown> = { id };\n  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {\n    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId;\n    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId;\n  }\n  const attachment = await em.findOne(Attachment, findFilter);\n  if (!attachment) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const partition = await em.findOne(AttachmentPartition, {\n    code: attachment.partitionCode,\n  });\n  if (!partition) {\n    return NextResponse.json(\n      { error: \"Partition misconfigured\" },\n      { status: 500 },\n    );\n  }\n\n  const access = checkAttachmentAccess(scopedAuth, attachment, partition);\n  if (!access.ok) {\n    const message = access.status === 401 ? \"Unauthorized\" : \"Forbidden\";\n    return NextResponse.json({ error: message }, { status: access.status });\n  }\n\n  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n    tenantId: attachment.tenantId ?? '',\n    organizationId: attachment.organizationId ?? '',\n  });\n  let buffer: Buffer;\n  try {\n    const result = await driver.read(attachment.partitionCode, attachment.storagePath);\n    buffer = result.buffer;\n  } catch {\n    return NextResponse.json({ error: \"File not available\" }, { status: 404 });\n  }\n\n  const url = new URL(req.url);\n  const forceDownload = url.searchParams.get(\"download\") === \"1\";\n  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);\n  const headers: Record<string, string> = {\n    \"Cache-Control\": checkAttachmentAccess(null, attachment, partition).ok\n      ? \"public, max-age=86400\"\n      : \"private, max-age=60\",\n    \"Content-Security-Policy\": \"default-src 'none'; sandbox\",\n    \"Content-Type\": renderInline\n      ? attachment.mimeType || \"application/octet-stream\"\n      : \"application/octet-stream\",\n    \"Content-Disposition\": buildAttachmentContentDisposition(\n      attachment.fileName,\n      renderInline ? \"inline\" : \"attachment\",\n    ),\n    \"X-Content-Type-Options\": \"nosniff\",\n  };\n  if (attachment.fileSize > 0) {\n    headers[\"Content-Length\"] = String(attachment.fileSize);\n  }\n\n  const responseBody = new Uint8Array(buffer);\n\n  return new NextResponse(responseBody, { status: 200, headers });\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: \"Download attachment file\",\n  methods: {\n    GET: {\n      summary: \"Download or serve attachment file\",\n      description:\n        \"Returns the raw file content for an attachment. Path parameter: {id} - Attachment UUID. Query parameter: ?download=1 - Force file download with Content-Disposition header. Access control is enforced based on partition settings.\",\n      responses: [\n        {\n          status: 200,\n          description: \"File content with appropriate MIME type\",\n          schema: z.any().describe(\"Binary file content\"),\n        },\n      ],\n      errors: [\n        {\n          status: 400,\n          description: \"Missing attachment ID\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 401,\n          description:\n            \"Unauthorized - authentication required for private partitions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 403,\n          description: \"Forbidden - insufficient permissions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 404,\n          description: \"Attachment or file not found\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 500,\n          description: \"Partition misconfigured\",\n          schema: attachmentErrorSchema,\n        },\n      ],\n    },\n  },\n};\n"],
-  "mappings": "AAAA,SAAsB,oBAAoB;AAE1C,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,uBAAuB,wBAAwB;AACxD,SAAS,SAAS;AAClB,SAAS,gBAAgB,6BAA6B;AACtD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAEvC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4BAA4B;AAAA,MACrC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KACzC,IAAI,qBAAqB,EAAE;AAE7B,QAAM,eAAe,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC7E,MAAI,aAAa,QAAQ;AACvB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,aAAa,OAAO,EAAE,GAAG,MAAM,OAAO,aAAa,eAAe,IAAI;AAC5E,QAAM,aAAsC,EAAE,GAAG;AACjD,MAAI,cAAc,CAAC,iBAAiB,UAAU,GAAG;AAC/C,QAAI,WAAW,SAAU,YAAW,WAAW,WAAW;AAC1D,QAAI,WAAW,MAAO,YAAW,iBAAiB,WAAW;AAAA,EAC/D;AACA,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,UAAU;AAC1D,MAAI,CAAC,YAAY;AACf,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB;AAAA,IACtD,MAAM,WAAW;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAW;AACd,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,0BAA0B;AAAA,MACnC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,SAAS,sBAAsB,YAAY,YAAY,SAAS;AACtE,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,WAAW,MAAM,iBAAiB;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,IACtF,UAAU,WAAW,YAAY;AAAA,IACjC,gBAAgB,WAAW,kBAAkB;AAAA,EAC/C,CAAC;AACD,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AACjF,aAAS,OAAO;AAAA,EAClB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,gBAAgB,IAAI,aAAa,IAAI,UAAU,MAAM;AAC3D,QAAM,eAAe,CAAC,iBAAiB,0BAA0B,WAAW,QAAQ;AACpF,QAAM,UAAkC;AAAA,IACtC,iBAAiB,sBAAsB,MAAM,YAAY,SAAS,EAAE,KAChE,0BACA;AAAA,IACJ,2BAA2B;AAAA,IAC3B,gBAAgB,eACZ,WAAW,YAAY,6BACvB;AAAA,IACJ,uBAAuB;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,WAAW;AAAA,IAC5B;AAAA,IACA,0BAA0B;AAAA,EAC5B;AACA,MAAI,WAAW,WAAW,GAAG;AAC3B,YAAQ,gBAAgB,IAAI,OAAO,WAAW,QAAQ;AAAA,EACxD;AAEA,QAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,SAAO,IAAI,aAAa,cAAc,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAChE;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,qBAAqB;AAAA,QAChD;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { createAttachmentAccessContext, evaluateAttachmentAccess } from '../../../lib/access-runner'\nimport { attachmentAccessErrorResponse } from '../../../lib/access-errors'\nimport { NextRequest, NextResponse } from \"next/server\";\nimport type { OpenApiRouteDoc } from \"@open-mercato/shared/lib/openapi\";\nimport { getAuthFromRequest } from \"@open-mercato/shared/lib/auth/server\";\nimport { createRequestContainer } from \"@open-mercato/shared/lib/di/container\";\nimport {\n  Attachment,\n  AttachmentPartition,\n} from \"@open-mercato/core/modules/attachments/data/entities\";\nimport type { EntityManager } from \"@mikro-orm/postgresql\";\nimport { checkAttachmentAccess, isSuperAdminAuth } from \"@open-mercato/core/modules/attachments/lib/access\";\nimport { z } from \"zod\";\nimport { attachmentsTag, attachmentErrorSchema } from \"../../openapi\";\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n} from \"@open-mercato/core/modules/attachments/lib/security\";\nimport { StorageDriverFactory } from '../../../lib/drivers';\nimport { resolveAttachmentRequestScope } from '@open-mercato/core/modules/attachments/lib/requestScope';\n\nexport const metadata = {\n  GET: { requireAuth: false },\n};\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string }> },\n) {\n  const { id } = await context.params;\n  if (!id) {\n    return NextResponse.json(\n      { error: \"Attachment id is required\" },\n      { status: 400 },\n    );\n  }\n  const auth = await getAuthFromRequest(req);\n  const container = await createRequestContainer();\n  const em = container.resolve(\"em\") as EntityManager;\n  const storageDriverFactory =\n    (container.resolve(\"storageDriverFactory\") as StorageDriverFactory | null) ??\n    new StorageDriverFactory(em);\n\n  const requestScope = await resolveAttachmentRequestScope(container, auth, req);\n  if (requestScope.denied) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const scopedAuth = auth ? { ...auth, orgId: requestScope.organizationId } : auth;\n  const findFilter: Record<string, unknown> = { id };\n  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {\n    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId;\n    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId;\n  }\n  const attachment = await em.findOne(Attachment, findFilter);\n  if (!attachment) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const partition = await em.findOne(AttachmentPartition, {\n    code: attachment.partitionCode,\n  });\n  if (!partition) {\n    return NextResponse.json(\n      { error: \"Partition misconfigured\" },\n      { status: 500 },\n    );\n  }\n\n  const url = new URL(req.url);\n  const forceDownload = url.searchParams.get(\"download\") === \"1\";\n  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);\n  const access = await evaluateAttachmentAccess({\n    auth: scopedAuth, attachment, partition, action: renderInline ? 'render' : 'read',\n    context: createAttachmentAccessContext(container),\n  });\n  if (!access.ok) return attachmentAccessErrorResponse(access);\n\n  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n    tenantId: attachment.tenantId ?? '',\n    organizationId: attachment.organizationId ?? '',\n  });\n  let buffer: Buffer;\n  try {\n    const result = await driver.read(attachment.partitionCode, attachment.storagePath);\n    buffer = result.buffer;\n  } catch {\n    return NextResponse.json({ error: \"File not available\" }, { status: 404 });\n  }\n\n  const headers: Record<string, string> = {\n    \"Cache-Control\": access.protected ? \"private, no-store\" : checkAttachmentAccess(null, attachment, partition).ok\n      ? \"public, max-age=86400\"\n      : \"private, max-age=60\",\n    \"Content-Security-Policy\": \"default-src 'none'; sandbox\",\n    \"Content-Type\": renderInline\n      ? attachment.mimeType || \"application/octet-stream\"\n      : \"application/octet-stream\",\n    \"Content-Disposition\": buildAttachmentContentDisposition(\n      attachment.fileName,\n      renderInline ? \"inline\" : \"attachment\",\n    ),\n    \"X-Content-Type-Options\": \"nosniff\",\n  };\n  if (attachment.fileSize > 0) {\n    headers[\"Content-Length\"] = String(attachment.fileSize);\n  }\n\n  const responseBody = new Uint8Array(buffer);\n\n  return new NextResponse(responseBody, { status: 200, headers });\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: \"Download attachment file\",\n  methods: {\n    GET: {\n      summary: \"Download or serve attachment file\",\n      description:\n        \"Returns the raw file content for an attachment. Path parameter: {id} - Attachment UUID. Query parameter: ?download=1 - Force file download with Content-Disposition header. Access control is enforced based on partition settings.\",\n      responses: [\n        {\n          status: 200,\n          description: \"File content with appropriate MIME type\",\n          schema: z.any().describe(\"Binary file content\"),\n        },\n      ],\n      errors: [\n        {\n          status: 400,\n          description: \"Missing attachment ID\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 401,\n          description:\n            \"Unauthorized - authentication required for private partitions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 403,\n          description: \"Forbidden - insufficient permissions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 404,\n          description: \"Attachment or file not found\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 500,\n          description: \"Partition misconfigured\",\n          schema: attachmentErrorSchema,\n        },\n        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n};\n"],
+  "mappings": "AAAA,SAAS,+BAA+B,gCAAgC;AACxE,SAAS,qCAAqC;AAC9C,SAAsB,oBAAoB;AAE1C,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,uBAAuB,wBAAwB;AACxD,SAAS,SAAS;AAClB,SAAS,gBAAgB,6BAA6B;AACtD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAEvC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4BAA4B;AAAA,MACrC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KACzC,IAAI,qBAAqB,EAAE;AAE7B,QAAM,eAAe,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC7E,MAAI,aAAa,QAAQ;AACvB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,aAAa,OAAO,EAAE,GAAG,MAAM,OAAO,aAAa,eAAe,IAAI;AAC5E,QAAM,aAAsC,EAAE,GAAG;AACjD,MAAI,cAAc,CAAC,iBAAiB,UAAU,GAAG;AAC/C,QAAI,WAAW,SAAU,YAAW,WAAW,WAAW;AAC1D,QAAI,WAAW,MAAO,YAAW,iBAAiB,WAAW;AAAA,EAC/D;AACA,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,UAAU;AAC1D,MAAI,CAAC,YAAY;AACf,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB;AAAA,IACtD,MAAM,WAAW;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAW;AACd,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,0BAA0B;AAAA,MACnC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,gBAAgB,IAAI,aAAa,IAAI,UAAU,MAAM;AAC3D,QAAM,eAAe,CAAC,iBAAiB,0BAA0B,WAAW,QAAQ;AACpF,QAAM,SAAS,MAAM,yBAAyB;AAAA,IAC5C,MAAM;AAAA,IAAY;AAAA,IAAY;AAAA,IAAW,QAAQ,eAAe,WAAW;AAAA,IAC3E,SAAS,8BAA8B,SAAS;AAAA,EAClD,CAAC;AACD,MAAI,CAAC,OAAO,GAAI,QAAO,8BAA8B,MAAM;AAE3D,QAAM,SAAS,MAAM,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,IACtF,UAAU,WAAW,YAAY;AAAA,IACjC,gBAAgB,WAAW,kBAAkB;AAAA,EAC/C,CAAC;AACD,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AACjF,aAAS,OAAO;AAAA,EAClB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,UAAkC;AAAA,IACtC,iBAAiB,OAAO,YAAY,sBAAsB,sBAAsB,MAAM,YAAY,SAAS,EAAE,KACzG,0BACA;AAAA,IACJ,2BAA2B;AAAA,IAC3B,gBAAgB,eACZ,WAAW,YAAY,6BACvB;AAAA,IACJ,uBAAuB;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,WAAW;AAAA,IAC5B;AAAA,IACA,0BAA0B;AAAA,EAC5B;AACA,MAAI,WAAW,WAAW,GAAG;AAC3B,YAAQ,gBAAgB,IAAI,OAAO,WAAW,QAAQ;AAAA,EACxD;AAEA,QAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,SAAO,IAAI,aAAa,cAAc,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAChE;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,qBAAqB;AAAA,QAChD;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,sBAAsB;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/attachments/api/image/[id]/[[...slug]]/route.js

@@ -1,3 +1,5 @@
+import { createAttachmentAccessContext, evaluateAttachmentAccess } from "../../../../lib/access-runner.js";
+import { attachmentAccessErrorResponse } from "../../../../lib/access-errors.js";
 import { NextResponse } from "next/server";
 import sharp from "sharp";
 import { z } from "zod";
@@ -59,17 +61,20 @@ async function GET(req, context) {
   if (!attachment) {
     return NextResponse.json({ error: "Not found" }, { status: 404 });
   }
-  if (!canRenderInlineAttachment(attachment.mimeType)) {
-    return NextResponse.json({ error: "Unsupported media type" }, { status: 400 });
-  }
   const partition = await em.findOne(AttachmentPartition, { code: attachment.partitionCode });
   if (!partition) {
     return NextResponse.json({ error: "Partition misconfigured" }, { status: 500 });
   }
-  const access = checkAttachmentAccess(scopedAuth, attachment, partition);
-  if (!access.ok) {
-    const message = access.status === 401 ? "Unauthorized" : "Forbidden";
-    return NextResponse.json({ error: message }, { status: access.status });
+  const access = await evaluateAttachmentAccess({
+    auth: scopedAuth,
+    attachment,
+    partition,
+    action: "render",
+    context: createAttachmentAccessContext(container)
+  });
+  if (!access.ok) return attachmentAccessErrorResponse(access);
+  if (!canRenderInlineAttachment(attachment.mimeType)) {
+    return NextResponse.json({ error: "Unsupported media type" }, { status: 400 });
   }
   const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {
     tenantId: attachment.tenantId ?? "",
@@ -120,7 +125,7 @@ async function GET(req, context) {
     return new NextResponse(responseBody, {
       headers: {
         "Content-Type": attachment.mimeType || "image/jpeg",
-        "Cache-Control": checkAttachmentAccess(null, attachment, partition).ok ? "public, max-age=3600" : "private, max-age=60",
+        "Cache-Control": access.protected ? "private, no-store" : checkAttachmentAccess(null, attachment, partition).ok ? "public, max-age=3600" : "private, max-age=60",
         "X-Content-Type-Options": "nosniff"
       }
     });
@@ -148,7 +153,8 @@ const openApi = {
         { status: 401, description: "Unauthorized - authentication required for private partitions", schema: attachmentErrorSchema },
         { status: 403, description: "Forbidden - insufficient permissions", schema: attachmentErrorSchema },
         { status: 404, description: "Image not found", schema: attachmentErrorSchema },
-        { status: 500, description: "Partition misconfigured or image rendering failed", schema: attachmentErrorSchema }
+        { status: 500, description: "Partition misconfigured or image rendering failed", schema: attachmentErrorSchema },
+        { status: 504, description: "Owner authorization timed out", schema: attachmentErrorSchema }
       ]
     }
   }

package/dist/modules/attachments/api/image/[id]/[[...slug]]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/attachments/api/image/%5Bid%5D/%5B%5B...slug%5D%5D/route.ts"],
-  "sourcesContent": ["import { NextRequest, NextResponse } from 'next/server'\nimport sharp, { type ResizeOptions } from 'sharp'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { Attachment, AttachmentPartition } from '@open-mercato/core/modules/attachments/data/entities'\nimport {\n  buildThumbnailCacheKey,\n  readThumbnailCache,\n  writeThumbnailCache,\n} from '@open-mercato/core/modules/attachments/lib/thumbnailCache'\nimport { canRenderInlineAttachment } from '@open-mercato/core/modules/attachments/lib/security'\nimport { checkAttachmentAccess, isSuperAdminAuth } from '@open-mercato/core/modules/attachments/lib/access'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { attachmentsTag, imageQuerySchema, attachmentErrorSchema } from '../../../openapi'\nimport {\n  MAX_IMAGE_SOURCE_PIXELS,\n  validateImageDimensions,\n  validateImageMagicBytes,\n} from '@open-mercato/core/modules/attachments/lib/imageSafety'\nimport { StorageDriverFactory } from '../../../../lib/drivers'\nimport { resolveAttachmentRequestScope } from '@open-mercato/core/modules/attachments/lib/requestScope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('attachments').child({ component: 'image' })\n\nconst querySchema = z.object({\n  width: z.coerce.number().int().min(1).max(4000).optional(),\n  height: z.coerce.number().int().min(1).max(4000).optional(),\n  cropType: z.enum(['cover', 'contain']).optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string; slug?: string[] | undefined }> }\n) {\n  const auth = await getAuthFromRequest(req)\n  const { id } = await context.params\n  if (!id) {\n    return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  }\n  const parsedQuery = querySchema.safeParse(\n    Object.fromEntries(new URL(req.url).searchParams.entries())\n  )\n  if (!parsedQuery.success) {\n    return NextResponse.json({ error: 'Invalid size parameters' }, { status: 400 })\n  }\n  const { width, height, cropType } = parsedQuery.data\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const storageDriverFactory =\n    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n\n  const requestScope = await resolveAttachmentRequestScope(container, auth, req)\n  if (requestScope.denied) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n  const scopedAuth = auth ? { ...auth, orgId: requestScope.organizationId } : auth\n  const findFilter: Record<string, unknown> = { id }\n  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {\n    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId\n    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId\n  }\n  const attachment = await em.findOne(Attachment, findFilter)\n  if (!attachment) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n  if (!canRenderInlineAttachment(attachment.mimeType)) {\n    return NextResponse.json({ error: 'Unsupported media type' }, { status: 400 })\n  }\n  const partition = await em.findOne(AttachmentPartition, { code: attachment.partitionCode })\n  if (!partition) {\n    return NextResponse.json({ error: 'Partition misconfigured' }, { status: 500 })\n  }\n  const access = checkAttachmentAccess(scopedAuth, attachment, partition)\n  if (!access.ok) {\n    const message = access.status === 401 ? 'Unauthorized' : 'Forbidden'\n    return NextResponse.json({ error: message }, { status: access.status })\n  }\n\n  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n    tenantId: attachment.tenantId ?? '',\n    organizationId: attachment.organizationId ?? '',\n  })\n  const cacheKey = buildThumbnailCacheKey(width, height, cropType)\n  try {\n    let buffer: Buffer | null = null\n    if (cacheKey) {\n      buffer = await readThumbnailCache(attachment.partitionCode, attachment.id, cacheKey)\n    }\n    if (!buffer) {\n      const { buffer: input } = await driver.read(attachment.partitionCode, attachment.storagePath)\n      const magicBytesValidation = validateImageMagicBytes(input, attachment.mimeType)\n      if (!magicBytesValidation.ok) {\n        return NextResponse.json({ error: magicBytesValidation.error }, { status: magicBytesValidation.status })\n      }\n\n      const dimensionsValidation = await validateImageDimensions(input)\n      if (!dimensionsValidation.ok) {\n        return NextResponse.json({ error: dimensionsValidation.error }, { status: dimensionsValidation.status })\n      }\n\n      let transformer = sharp(input, {\n        failOn: 'error',\n        limitInputPixels: MAX_IMAGE_SOURCE_PIXELS,\n      })\n      if (width || height) {\n        const resizeOptions: ResizeOptions = {\n          width: width || undefined,\n          height: height || undefined,\n          fit: cropType === 'contain' ? 'contain' : 'cover',\n        }\n        if (cropType === 'contain') {\n          resizeOptions.background = { r: 0, g: 0, b: 0, alpha: 0 }\n        }\n        transformer = transformer.resize(resizeOptions)\n      }\n      buffer = await transformer.toBuffer()\n      if (cacheKey) {\n        void writeThumbnailCache(attachment.partitionCode, attachment.id, cacheKey, buffer).catch((cacheError) => {\n          logger.error('Thumbnail cache write failed', { err: cacheError })\n        })\n      }\n    }\n    if (!buffer) {\n      return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })\n    }\n    const responseBody = new Uint8Array(buffer)\n\n    return new NextResponse(responseBody, {\n      headers: {\n        'Content-Type': attachment.mimeType || 'image/jpeg',\n        'Cache-Control': checkAttachmentAccess(null, attachment, partition).ok ? 'public, max-age=3600' : 'private, max-age=60',\n        'X-Content-Type-Options': 'nosniff',\n      },\n    })\n  } catch (error) {\n    logger.error('Image read failed', { err: error })\n    return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Serve resized images',\n  methods: {\n    GET: {\n      summary: 'Serve image with optional resizing',\n      description: 'Returns an image attachment with optional on-the-fly resizing and cropping. Resized images are cached for performance. Only works with image MIME types. Path parameter: {id} - Attachment UUID. Query parameters: ?width=N (1-4000 pixels), ?height=N (1-4000 pixels), ?cropType=cover|contain (resize behavior).',\n      responses: [\n        {\n          status: 200,\n          description: 'Binary image content (Content-Type: image/jpeg, image/png, etc.)',\n          schema: z.any().describe('Binary image content - actual Content-Type header set to image MIME type, not application/json'),\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid parameters, missing ID, or non-image attachment', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized - authentication required for private partitions', schema: attachmentErrorSchema },\n        { status: 403, description: 'Forbidden - insufficient permissions', schema: attachmentErrorSchema },\n        { status: 404, description: 'Image not found', schema: attachmentErrorSchema },\n        { status: 500, description: 'Partition misconfigured or image rendering failed', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAsB,oBAAoB;AAC1C,OAAO,WAAmC;AAC1C,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,YAAY,2BAA2B;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAC1C,SAAS,uBAAuB,wBAAwB;AAExD,SAAS,gBAAkC,6BAA6B;AACxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC;AAEvE,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACzD,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC1D,UAAU,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC,EAAE,SAAS;AAClD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,cAAc,YAAY;AAAA,IAC9B,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,QAAQ,CAAC;AAAA,EAC5D;AACA,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,EAAE,OAAO,QAAQ,SAAS,IAAI,YAAY;AAEhD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AAE3G,QAAM,eAAe,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC7E,MAAI,aAAa,QAAQ;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,QAAM,aAAa,OAAO,EAAE,GAAG,MAAM,OAAO,aAAa,eAAe,IAAI;AAC5E,QAAM,aAAsC,EAAE,GAAG;AACjD,MAAI,cAAc,CAAC,iBAAiB,UAAU,GAAG;AAC/C,QAAI,WAAW,SAAU,YAAW,WAAW,WAAW;AAC1D,QAAI,WAAW,MAAO,YAAW,iBAAiB,WAAW;AAAA,EAC/D;AACA,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,UAAU;AAC1D,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,CAAC,0BAA0B,WAAW,QAAQ,GAAG;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,WAAW,cAAc,CAAC;AAC1F,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,sBAAsB,YAAY,YAAY,SAAS;AACtE,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,WAAW,MAAM,iBAAiB;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,IACtF,UAAU,WAAW,YAAY;AAAA,IACjC,gBAAgB,WAAW,kBAAkB;AAAA,EAC/C,CAAC;AACD,QAAM,WAAW,uBAAuB,OAAO,QAAQ,QAAQ;AAC/D,MAAI;AACF,QAAI,SAAwB;AAC5B,QAAI,UAAU;AACZ,eAAS,MAAM,mBAAmB,WAAW,eAAe,WAAW,IAAI,QAAQ;AAAA,IACrF;AACA,QAAI,CAAC,QAAQ;AACX,YAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AAC5F,YAAM,uBAAuB,wBAAwB,OAAO,WAAW,QAAQ;AAC/E,UAAI,CAAC,qBAAqB,IAAI;AAC5B,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,MAAM,GAAG,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,MACzG;AAEA,YAAM,uBAAuB,MAAM,wBAAwB,KAAK;AAChE,UAAI,CAAC,qBAAqB,IAAI;AAC5B,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,MAAM,GAAG,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,MACzG;AAEA,UAAI,cAAc,MAAM,OAAO;AAAA,QAC7B,QAAQ;AAAA,QACR,kBAAkB;AAAA,MACpB,CAAC;AACD,UAAI,SAAS,QAAQ;AACnB,cAAM,gBAA+B;AAAA,UACnC,OAAO,SAAS;AAAA,UAChB,QAAQ,UAAU;AAAA,UAClB,KAAK,aAAa,YAAY,YAAY;AAAA,QAC5C;AACA,YAAI,aAAa,WAAW;AAC1B,wBAAc,aAAa,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,OAAO,EAAE;AAAA,QAC1D;AACA,sBAAc,YAAY,OAAO,aAAa;AAAA,MAChD;AACA,eAAS,MAAM,YAAY,SAAS;AACpC,UAAI,UAAU;AACZ,aAAK,oBAAoB,WAAW,eAAe,WAAW,IAAI,UAAU,MAAM,EAAE,MAAM,CAAC,eAAe;AACxG,iBAAO,MAAM,gCAAgC,EAAE,KAAK,WAAW,CAAC;AAAA,QAClE,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,UAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,WAAO,IAAI,aAAa,cAAc;AAAA,MACpC,SAAS;AAAA,QACP,gBAAgB,WAAW,YAAY;AAAA,QACvC,iBAAiB,sBAAsB,MAAM,YAAY,SAAS,EAAE,KAAK,yBAAyB;AAAA,QAClG,0BAA0B;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,qBAAqB,EAAE,KAAK,MAAM,CAAC;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,gGAAgG;AAAA,QAC3H;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,2DAA2D,QAAQ,sBAAsB;AAAA,QACrH,EAAE,QAAQ,KAAK,aAAa,iEAAiE,QAAQ,sBAAsB;AAAA,QAC3H,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,sBAAsB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qDAAqD,QAAQ,sBAAsB;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { createAttachmentAccessContext, evaluateAttachmentAccess } from '../../../../lib/access-runner'\nimport { attachmentAccessErrorResponse } from '../../../../lib/access-errors'\nimport { NextRequest, NextResponse } from 'next/server'\nimport sharp, { type ResizeOptions } from 'sharp'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { Attachment, AttachmentPartition } from '@open-mercato/core/modules/attachments/data/entities'\nimport {\n  buildThumbnailCacheKey,\n  readThumbnailCache,\n  writeThumbnailCache,\n} from '@open-mercato/core/modules/attachments/lib/thumbnailCache'\nimport { canRenderInlineAttachment } from '@open-mercato/core/modules/attachments/lib/security'\nimport { checkAttachmentAccess, isSuperAdminAuth } from '@open-mercato/core/modules/attachments/lib/access'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { attachmentsTag, imageQuerySchema, attachmentErrorSchema } from '../../../openapi'\nimport {\n  MAX_IMAGE_SOURCE_PIXELS,\n  validateImageDimensions,\n  validateImageMagicBytes,\n} from '@open-mercato/core/modules/attachments/lib/imageSafety'\nimport { StorageDriverFactory } from '../../../../lib/drivers'\nimport { resolveAttachmentRequestScope } from '@open-mercato/core/modules/attachments/lib/requestScope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('attachments').child({ component: 'image' })\n\nconst querySchema = z.object({\n  width: z.coerce.number().int().min(1).max(4000).optional(),\n  height: z.coerce.number().int().min(1).max(4000).optional(),\n  cropType: z.enum(['cover', 'contain']).optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string; slug?: string[] | undefined }> }\n) {\n  const auth = await getAuthFromRequest(req)\n  const { id } = await context.params\n  if (!id) {\n    return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  }\n  const parsedQuery = querySchema.safeParse(\n    Object.fromEntries(new URL(req.url).searchParams.entries())\n  )\n  if (!parsedQuery.success) {\n    return NextResponse.json({ error: 'Invalid size parameters' }, { status: 400 })\n  }\n  const { width, height, cropType } = parsedQuery.data\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const storageDriverFactory =\n    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n\n  const requestScope = await resolveAttachmentRequestScope(container, auth, req)\n  if (requestScope.denied) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n  const scopedAuth = auth ? { ...auth, orgId: requestScope.organizationId } : auth\n  const findFilter: Record<string, unknown> = { id }\n  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {\n    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId\n    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId\n  }\n  const attachment = await em.findOne(Attachment, findFilter)\n  if (!attachment) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n  const partition = await em.findOne(AttachmentPartition, { code: attachment.partitionCode })\n  if (!partition) {\n    return NextResponse.json({ error: 'Partition misconfigured' }, { status: 500 })\n  }\n  const access = await evaluateAttachmentAccess({\n    auth: scopedAuth, attachment, partition, action: 'render', context: createAttachmentAccessContext(container),\n  })\n  if (!access.ok) return attachmentAccessErrorResponse(access)\n  if (!canRenderInlineAttachment(attachment.mimeType)) {\n    return NextResponse.json({ error: 'Unsupported media type' }, { status: 400 })\n  }\n\n  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n    tenantId: attachment.tenantId ?? '',\n    organizationId: attachment.organizationId ?? '',\n  })\n  const cacheKey = buildThumbnailCacheKey(width, height, cropType)\n  try {\n    let buffer: Buffer | null = null\n    if (cacheKey) {\n      buffer = await readThumbnailCache(attachment.partitionCode, attachment.id, cacheKey)\n    }\n    if (!buffer) {\n      const { buffer: input } = await driver.read(attachment.partitionCode, attachment.storagePath)\n      const magicBytesValidation = validateImageMagicBytes(input, attachment.mimeType)\n      if (!magicBytesValidation.ok) {\n        return NextResponse.json({ error: magicBytesValidation.error }, { status: magicBytesValidation.status })\n      }\n\n      const dimensionsValidation = await validateImageDimensions(input)\n      if (!dimensionsValidation.ok) {\n        return NextResponse.json({ error: dimensionsValidation.error }, { status: dimensionsValidation.status })\n      }\n\n      let transformer = sharp(input, {\n        failOn: 'error',\n        limitInputPixels: MAX_IMAGE_SOURCE_PIXELS,\n      })\n      if (width || height) {\n        const resizeOptions: ResizeOptions = {\n          width: width || undefined,\n          height: height || undefined,\n          fit: cropType === 'contain' ? 'contain' : 'cover',\n        }\n        if (cropType === 'contain') {\n          resizeOptions.background = { r: 0, g: 0, b: 0, alpha: 0 }\n        }\n        transformer = transformer.resize(resizeOptions)\n      }\n      buffer = await transformer.toBuffer()\n      if (cacheKey) {\n        void writeThumbnailCache(attachment.partitionCode, attachment.id, cacheKey, buffer).catch((cacheError) => {\n          logger.error('Thumbnail cache write failed', { err: cacheError })\n        })\n      }\n    }\n    if (!buffer) {\n      return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })\n    }\n    const responseBody = new Uint8Array(buffer)\n\n    return new NextResponse(responseBody, {\n      headers: {\n        'Content-Type': attachment.mimeType || 'image/jpeg',\n        'Cache-Control': access.protected ? 'private, no-store' : checkAttachmentAccess(null, attachment, partition).ok ? 'public, max-age=3600' : 'private, max-age=60',\n        'X-Content-Type-Options': 'nosniff',\n      },\n    })\n  } catch (error) {\n    logger.error('Image read failed', { err: error })\n    return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Serve resized images',\n  methods: {\n    GET: {\n      summary: 'Serve image with optional resizing',\n      description: 'Returns an image attachment with optional on-the-fly resizing and cropping. Resized images are cached for performance. Only works with image MIME types. Path parameter: {id} - Attachment UUID. Query parameters: ?width=N (1-4000 pixels), ?height=N (1-4000 pixels), ?cropType=cover|contain (resize behavior).',\n      responses: [\n        {\n          status: 200,\n          description: 'Binary image content (Content-Type: image/jpeg, image/png, etc.)',\n          schema: z.any().describe('Binary image content - actual Content-Type header set to image MIME type, not application/json'),\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid parameters, missing ID, or non-image attachment', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized - authentication required for private partitions', schema: attachmentErrorSchema },\n        { status: 403, description: 'Forbidden - insufficient permissions', schema: attachmentErrorSchema },\n        { status: 404, description: 'Image not found', schema: attachmentErrorSchema },\n        { status: 500, description: 'Partition misconfigured or image rendering failed', schema: attachmentErrorSchema },\n        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,+BAA+B,gCAAgC;AACxE,SAAS,qCAAqC;AAC9C,SAAsB,oBAAoB;AAC1C,OAAO,WAAmC;AAC1C,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,YAAY,2BAA2B;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAC1C,SAAS,uBAAuB,wBAAwB;AAExD,SAAS,gBAAkC,6BAA6B;AACxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC;AAEvE,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACzD,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC1D,UAAU,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC,EAAE,SAAS;AAClD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,cAAc,YAAY;AAAA,IAC9B,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,QAAQ,CAAC;AAAA,EAC5D;AACA,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,EAAE,OAAO,QAAQ,SAAS,IAAI,YAAY;AAEhD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AAE3G,QAAM,eAAe,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC7E,MAAI,aAAa,QAAQ;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,QAAM,aAAa,OAAO,EAAE,GAAG,MAAM,OAAO,aAAa,eAAe,IAAI;AAC5E,QAAM,aAAsC,EAAE,GAAG;AACjD,MAAI,cAAc,CAAC,iBAAiB,UAAU,GAAG;AAC/C,QAAI,WAAW,SAAU,YAAW,WAAW,WAAW;AAC1D,QAAI,WAAW,MAAO,YAAW,iBAAiB,WAAW;AAAA,EAC/D;AACA,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,UAAU;AAC1D,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,WAAW,cAAc,CAAC;AAC1F,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,MAAM,yBAAyB;AAAA,IAC5C,MAAM;AAAA,IAAY;AAAA,IAAY;AAAA,IAAW,QAAQ;AAAA,IAAU,SAAS,8BAA8B,SAAS;AAAA,EAC7G,CAAC;AACD,MAAI,CAAC,OAAO,GAAI,QAAO,8BAA8B,MAAM;AAC3D,MAAI,CAAC,0BAA0B,WAAW,QAAQ,GAAG;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,SAAS,MAAM,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,IACtF,UAAU,WAAW,YAAY;AAAA,IACjC,gBAAgB,WAAW,kBAAkB;AAAA,EAC/C,CAAC;AACD,QAAM,WAAW,uBAAuB,OAAO,QAAQ,QAAQ;AAC/D,MAAI;AACF,QAAI,SAAwB;AAC5B,QAAI,UAAU;AACZ,eAAS,MAAM,mBAAmB,WAAW,eAAe,WAAW,IAAI,QAAQ;AAAA,IACrF;AACA,QAAI,CAAC,QAAQ;AACX,YAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AAC5F,YAAM,uBAAuB,wBAAwB,OAAO,WAAW,QAAQ;AAC/E,UAAI,CAAC,qBAAqB,IAAI;AAC5B,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,MAAM,GAAG,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,MACzG;AAEA,YAAM,uBAAuB,MAAM,wBAAwB,KAAK;AAChE,UAAI,CAAC,qBAAqB,IAAI;AAC5B,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,MAAM,GAAG,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,MACzG;AAEA,UAAI,cAAc,MAAM,OAAO;AAAA,QAC7B,QAAQ;AAAA,QACR,kBAAkB;AAAA,MACpB,CAAC;AACD,UAAI,SAAS,QAAQ;AACnB,cAAM,gBAA+B;AAAA,UACnC,OAAO,SAAS;AAAA,UAChB,QAAQ,UAAU;AAAA,UAClB,KAAK,aAAa,YAAY,YAAY;AAAA,QAC5C;AACA,YAAI,aAAa,WAAW;AAC1B,wBAAc,aAAa,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,OAAO,EAAE;AAAA,QAC1D;AACA,sBAAc,YAAY,OAAO,aAAa;AAAA,MAChD;AACA,eAAS,MAAM,YAAY,SAAS;AACpC,UAAI,UAAU;AACZ,aAAK,oBAAoB,WAAW,eAAe,WAAW,IAAI,UAAU,MAAM,EAAE,MAAM,CAAC,eAAe;AACxG,iBAAO,MAAM,gCAAgC,EAAE,KAAK,WAAW,CAAC;AAAA,QAClE,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,UAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,WAAO,IAAI,aAAa,cAAc;AAAA,MACpC,SAAS;AAAA,QACP,gBAAgB,WAAW,YAAY;AAAA,QACvC,iBAAiB,OAAO,YAAY,sBAAsB,sBAAsB,MAAM,YAAY,SAAS,EAAE,KAAK,yBAAyB;AAAA,QAC3I,0BAA0B;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,qBAAqB,EAAE,KAAK,MAAM,CAAC;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,gGAAgG;AAAA,QAC3H;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,2DAA2D,QAAQ,sBAAsB;AAAA,QACrH,EAAE,QAAQ,KAAK,aAAa,iEAAiE,QAAQ,sBAAsB;AAAA,QAC3H,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,sBAAsB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qDAAqD,QAAQ,sBAAsB;AAAA,QAC/G,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,sBAAsB;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }